Examkin

Question

Difficulty: Very hardAutomating Deployment and Configuration Management

An enterprise manages a web application infrastructure deployed via AWS CloudFormation. The stack includes an Auto Scaling Group (ASG) of Amazon EC2 instances behind an Application Load Balancer (ALB). The instances use AWS Systems Manager State Manager to run an association that installs security agents and configures application dependencies, which takes approximately 8 minutes.

During a recent traffic spike, the enterprise faced two major issues:
1. The ASG rapidly launched multiple new instances. However, because the instance bootstrapping took longer than the default cooldown period, the ASG continuously launched unnecessary instances before the initial ones could start serving traffic, exhausting the regional vCPU quota. Additionally, new instances were registered with the ALB and began receiving traffic before the State Manager association completed, causing client request failures.
2. A subsequent CloudFormation stack update failed and rolled back because operators had manually adjusted security group rules and EC2 instance types directly in the console to mitigate the traffic spike.

Which design strategy should a solutions architect implement to automate deployment, secure configuration compliance, and resolve the drift issues?

  1. A
    Implement an AWS CodePipeline that uses AWS CodeDeploy to perform a rolling update of the application configurations on the EC2 instances. Set the CodeDeploy deployment configuration to use a linear traffic-shifting strategy. To resolve configuration drift, configure AWS Config to trigger a custom AWS Lambda function that automatically terminates any drifted EC2 instance and deletes modified security groups to force CloudFormation to recreate them during the next stack run.
  2. B
    Configure the Application Load Balancer health check grace period to 10 minutes to allow the State Manager association to complete. Decrease the Auto Scaling scaling policy's cooldown period to 3 minutes to ensure the group can respond quickly to traffic spikes. To resolve configuration drift, enable automatic drift remediation in the AWS CloudFormation stack settings so that the service automatically reverts any manual console modifications during subsequent stack updates.
  3. Configure an Auto Scaling lifecycle hook for the transition to pause the instance in a wait state during launch. Update the Systems Manager State Manager association to execute the configuration script and run a command that invokes the complete-lifecycle-action API once configuration is successful. Increase the Auto Scaling group scaling policy's cooldown period to be greater than the 8-minute bootstrapping time. To manage drift, perform CloudFormation drift detection, and manually or programmatically revert the drifted resource attributes to match the template before running stack updates.Answer
  4. D
    Configure an Auto Scaling lifecycle hook for the transition and invoke it via an EC2 User Data script that calls the complete-lifecycle-action API immediately upon instance startup. Set the Auto Scaling group's cooldown period to zero to prevent delayed scaling. To prevent configuration drift, attach a Service Control Policy (SCP) to the organization unit that denies the ec2:ModifyInstanceAttribute and ec2:AuthorizeSecurityGroupIngress actions for all principals, assuming this policy grants exclusive update permissions to the CloudFormation service role.

Answer

Configure an Auto Scaling lifecycle hook to pause the launching instance, update the Systems Manager State Manager association to complete the lifecycle hook upon configuration completion, increase the ASG scaling policy's cooldown period to exceed the bootstrap time, and use CloudFormation drift detection to identify and revert drifted resource attributes prior to running stack updates.
The correct strategy uses an Auto Scaling lifecycle hook to keep the launching instances in a wait state until the State Manager association completes and signals completion via the CLI/API. Increasing the cooldown period beyond the bootstrap time prevents premature scale-out events. Performing drift detection and manually or programmatically aligning the resource configurations with the template prevents stack update failures.

Step-by-Step Solution

1
Implement an Auto Scaling lifecycle hook for the EC2_INSTANCE_LAUNCHING transition.
Newly launched EC2 instances are paused in the Pending:Wait state, preventing them from registering with the Application Load Balancer and receiving traffic.
This ensures that instances are fully configured before serving production traffic, preventing client request failures.
2
Configure the State Manager association's script to invoke the complete-lifecycle-action command.
Once the security agents and application dependencies are installed, the lifecycle hook transitions the instance to the InService state.
This automates the configuration flow, ensuring the instance is only marked healthy and active after satisfying all compliance requirements.
3
Increase the scaling policy's cooldown period to be greater than the 8-minute bootstrap time.
The Auto Scaling Group waits for the newly launched instance to be fully operational and its metric impact to stabilize before initiating another scaling action.
This prevents scaling loops and storms where multiple unnecessary instances are spun up under load.
4
Run CloudFormation drift detection and align configurations before deploying updates.
Drift is identified, allowing operations to revert manual modifications to match the CloudFormation templates.
This guarantees that subsequent stack updates succeed and prevents failures or resource rollbacks during deployments.

Key Concept

Auto Scaling Lifecycle Hooks and Configuration Management Integration
Estimated Time:3m 0s
Rate this question

Topics

Automating Deployment and Configuration Management